Incident Response Analyst

Incident Response Analyst (AI Training)

We're partnering with world-leading AI research labs to build the next generation of cybersecurity AI. As an Incident Response Analyst, you'll bring your real-world SOC experience to help train and evaluate AI systems designed to detect threats, correlate alerts, and support digital investigations — making sure these tools think like the best analysts in the field. This is a unique opportunity to move beyond the alert queue and directly influence how AI understands and responds to security incidents.

• Organization:
  Alignerr
• Type:
  Hourly Contract
• Location:
  
  Remote
• Commitment: 10–40 hours/week

• Analyze realistic security events, alerts, and incident cases to evaluate AI-generated responses
• Assess impact, root cause, and appropriate remediation steps for simulated and real-world scenarios
• Review detection rules, alerting pipelines, and investigative playbooks for accuracy and completeness
• Verify that AI-generated incident analysis reflects how real security operations teams actually work
• Provide structured, expert feedback to improve AI model quality and reliability

• 2+ years of hands-on experience in a SOC, incident response, or security operations role
• Comfortable working with SIEM platforms, alert queues, and investigation tooling
• Skilled at triaging signals and separating genuine threats from noise
• Able to articulate your reasoning clearly in written form
• Self-directed and reliable in an async, remote work environment

• Experience with threat hunting, digital forensics, or purple team operations
• Familiarity with frameworks such as MITRE ATT&CK or NIST IR
• Background in reviewing or writing detection content or playbooks
• Prior exposure to AI evaluation or data labeling workflows

• Work on frontier AI systems being built with top-tier research organizations
• Fully remote and flexible — set your own schedule and workload
• Freelance autonomy with meaningful, intellectually engaging work
• Contribute to AI that could shape the future of cybersecurity operations
• Potential for ongoing work and contract extension based on performance